On Mon, Apr 04, 2011 at 05:12:58PM -0700, Kees Cook wrote:
On Fri, Apr 01, 2011 at 08:47:19AM +0200, Tomas Mraz wrote:
> On Thu, 2011-03-31 at 15:16 -0700, Kees Cook wrote:
> > Since the kernel sets a number of dynamic rlimits based on the system
> > properties (e.g. physical memory for nproc), these rlimits should be
> > respected by PAM. Parse /proc/1/limits for the kernel-defined rlimits.
>
> Please provide a better rationale for the patch. The pam_limits module
> will not change any limits that are not set in the configuration file.
> And for the limits that are set there, the value in the configuration
> file should be respected. If I understand your patch correctly, you
> basically want to reset the limit to the values set on the init process.
> This definitely should not be a default behavior.
This patch provides the lowest level of default. The configuration files
will always override them if the config is present.
The primary reason for doing this is that when PAM runs, it may not have a
sensible set of default rlimits,
It may or it may not. With your patch, rlimits of applications would be
totally ignored in favour of init's rlimits. I'm not sure such a change
of default is quite safe wrt applications which may rely on ability to
define default rlimits.
so it should always start over from the kernel-defined defaults.
I'm not quite sure that it must _always_ drop rlimits inheritance.
While the feature looks useful, I think it have to be configurable via
some on/off switch.
--
ldv